A domain drill is kept with its verdict: POST /api/v1/drills (admin only) and a pure verdict against the domain's words #1851

Split from #1195. Builds on the map from the issue this waits for.

Done looks like:

• [ ] A pure src/kernel/domain_drill.ts: (domain, what health and the board said while down, seconds until back) in, {green, why} out. It is green when every says phrase of the domain was seen and the forge was back within its minutes. Otherwise it is red, naming the missing phrase or the overrun.
• [ ] A domain_drill table (a new migration that follows the repository's current migration convention; see #1837) keeps every result.
• [ ] POST /api/v1/drills takes an admin token or a same-origin admin session, validates the domain against the map and caps the size of the observations, then stores the result with its verdict. A non-admin gets 403 and an unknown domain gets 422.
• [ ] Tests: green, red on a missing phrase, red on overrun, 403, 422. The test file is named in GATE.

Files: src/kernel/domain_drill.ts, src/core/schema.ts, its route in src/http/server.ts, a test, scripts/gate.ts.